Dynamic Layer 3 VPNs with Multipoint GRE Tunnels

First Published: January 23, 2003

Last Updated: May 20, 2010

The Dynamic Layer 3 VPNs with Multipoint GRE Tunnels feature provides a Layer 3 (L3) transport mechanism based on an enhanced multipoint generic routing encapsulation (mGRE) tunneling technology for use in IP networks. The dynamic Layer 3 tunneling transport can also be used within IP networks to transport Virtual Private Network (VPN) traffic across service provider and enterprise networks, and to provide interoperability for packet transport between IP and Multiprotocol Label Switching (MPLS) VPNs. This feature provides support for RFC 2547, which defines the outsourcing of IP backbone services for enterprise networks.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Dynamic L3 VPNs with mGRE Tunnels" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Dynamic L3 VPNs with mGRE Tunnels

Before you configure the Dynamic Layer 3 VPNs with Multipoint GRE Tunnels feature, ensure that your MPLS VPN is configured and working properly. See the "Configuring MPLS Layer 3 VPNs" module for information about setting up MPLS VPNs.

Restrictions for Dynamic L3 VPNs with mGRE Tunnels

•The deployment of a MPLS VPN using both IP/GRE and MPLS encapsulation within a single network is not supported.

Information About Dynamic L3 VPNs with mGRE Tunnels

You can configure mGRE tunnels to create a multipoint tunnel network that overlays an IP backbone. This overlay connects PE routers to transport VPN traffic. To deploy L3 VPN mGRE tunnels, you create a VRF instance, create the mGRE tunnel, redirect the VPN IP traffic to the tunnel, and set up the BGP VPNv4 exchange so that updates are filtered through a route map and interesting prefixes are resolved in the VRF table.

In addition, when MPLS VPNs are configured over mGRE, you can deploy L3 PE-based VPN services using a standards-based IP core. This allows you to provision the VPN services without using the overlay method. When an MPLS VPN over mGRE is configured, the system uses IPv4-based mGRE tunnels to encapsulate VPN-labeled IPv4 and IPv6 packets between PEs.

Layer 3 mGRE Tunnels

By configuring mGRE tunnels, you create a multipoint tunnel network as an overlay to the IP backbone. This overlay interconnects the PE routers to transport VPN traffic through the backbone. This multipoint tunnel network uses Border Gateway Protocol (BGP) to distribute VPNv4 routing information between PE routers, maintaining the peer relationship between the service provider or enterprise network and customer sites. The advertised next hop in BGP VPNv4 triggers tunnel endpoint discovery. This feature provides the ability for multiple service providers to cooperate and offer a joint VPN service with traffic tunneled directly from the ingress PE router at one service provider directly to the egress PE router at a different service provider site.

In addition to providing the VPN transport capability, the mGRE tunnels create a full-mesh topology and reduce the administrative and operational overhead previously associated with a full mesh of point-to-point tunnels used to interconnect multiple customer sites. The configuration requirements are greatly reduced and enable the network to grow with minimal additional configuration.

Dynamic L3 tunnels provide for better scaling when creating partial-mesh or full-mesh VPNs. Adding new remote VPN peers is simplified because only the new router needs to be configured. The new address is learned dynamically and propagated to the nodes in the network. The dynamic routing capability dramatically reduces the size of configuration needed on all routers in the VPN, such that with the use of multipoint tunnels, only one tunnel interface needs to be configured on a PE that services many VPNs. The L3 mGRE tunnels need to be configured only on the PE router. Features available with GRE are still available with mGRE, including dynamic IP routing and IP multicast and Cisco Express Forwarding (CEF) switching of mGRE/Next Hop Routing Protocol (NHRP) tunnel traffic.

Interconnecting Provider Edge Routers Within an IP Network

The Dynamic Layer 3 VPNs with Multipoint GRE Tunnels feature allows you to create a multiaccess tunnel network to interconnect the PE routers that service your IP network. This tunnel network transports IP VPN traffic to all of the PE routers. Figure 1 illustrates the tunnel overlay network used in an IP network to transport VPN traffic between the PE routers.

The multiaccess tunnel overlay network provides full connectivity between PE routers. The PE routers exchange VPN routes by using BGP as defined in RFC 2547. IP traffic is redirected through the multipoint tunnel overlay network using distinct IP address spaces for the overlay and transport networks and by changing the address space instead of changing the numerical value of the address.

Packet Transport Between IP and MPLS Networks

Layer 3 mGRE tunnels can be used as a packet transport mechanism between IP and MPLS networks. To enable the packet transport between the two different protocols, one PE router on one side of the connection between the two networks must run MPLS. Figure 2 shows how mGRE tunnels can be used to transport VPN traffic between PE routers.

Figure 2 mGRE Used to Transport VPN Traffic Between IP and MPLS Network

For the packet transport to occur between the IP and MPLS network, the MPLS VPN label is mapped to the GRE key. The mapping takes place on the router where both mGRE and MPLS are configured. In Figure 2 the mapping of the label to the key occurs on Router M, which sits on the MPLS network.

BGP Next Hop Verification

BGP performs the BGP path selection, or next hop verification, at the PE. For a BGP path to a network to be considered in the path selection process, the next hop for the path must be reachable in the Interior Gateway Protocol (IGP). When an IP prefix is received and advertised as the next hop IP address, the IP traffic is tunneled from the source to the destination by switching the address space of the next hop.

Creating the VRF and mGRE Tunnel

The tunnel that transports the VPN traffic across the service provider network resides in its own address space. A special VRF instance must be created called Resolve in VRF (RiV). This section describes how to create the VRF and GRE tunnel.

Prerequisites

The IP address on the interface should be the same as that of the source interface specified in the configuration. The source interface specified should match that used by BGP as a source for the VPNv4 update.

Note Tunnel mode IPSec is not supported on MPLS over GRE Tunnel.

SUMMARY STEPS

1. enable

2. configureterminal

3. ip vrf vrf-name

4. rd 1:1

5. interface tunnel tunnel name

6. ip addressip-address subnet-id

7. tunnel source loopbackn

8. tunnel mode gre multipoint l3vpn

9. tunnel keygre-key

10. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configureterminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

ip vrfvrf-name

Example:

Router(config)# ip vrf customer a riv

Creates the special Resolve in VRF (RiV) VRF instance and table that will be used for the tunnel and redirection of the IP address.

Step 4

rd 1:1

Example:

Router(config-vrf)# rd 1:1

Enters the VRF configuration mode and specifies a route distinguisher (RD) for a VPN VRF instance.

Step 5

interface tunnel tunnel-name

Example:

Router(config-vrf)# interface tunnel 1

Enters interface configuration mode to create the tunnel.

Step 6

ip address ip-address subnet-id

Example:

Router(config-if)# ipaddress 209.165.200.225 255.255.255.224

Specifies the IP address for the tunnel.

Step 7

tunnel source loopbackn

Example:

Router(config-if)# tunnel source loopback test1

Creates the loopback interface.

Step 8

tunnel mode gre multipoint l3vpn

Example:

Router(config-if)# tunnel mode gre multipoint l3vpn

Sets the mode for the tunnel as "gre multipoint l3vpn".

Step 9

tunnel keygre-key

Example:

Router(config-if)# tunnel key 18

Specifies the GRE key for the tunnel.

Step 10

end

Example:

Router(config-if)# end

Exits the current configuration mode and returns to privileged EXEC mode.

Setting Up BGP VPN Exchange

The configuration task described in this section sets up the BGP VPNv4 exchange so that the updates are filtered through a route map and interesting prefixes are resolved in the VRF table.

Configures an Intermediate System-to-Intermediate System (IS-IS) routing process for IP on the interface and attaches a null area designator to the routing process.

Step 16

end

Example:

Router(config-if)#end

Exits the current configuration mode and returns to privileged EXEC mode.

Defining the Address Space and Specifying Address Resolution for MPLS VPNs over mGRE

This section describes how to define the address space and specify the address resolution for MPLS VPNs over mGRE. The following steps also enable you to link the route map to the application template and set up the BGP VPNv4 and VPNv6 exchange so that updates are filtered through the route map.

SUMMARY STEPS

1. enable

2. configureterminal

3. router bgpas-number

4. bgp log-neighbor-changes

5. neighborip-addressremote-asas-number

6. neighborip-addressupdate-sourceinterface name

7. address-family ipv4

8. no synchronization

9. redistribute connected

10. neighborip-addressactivate

11. no auto-summary

12. exit

13. address-family vpnv4

14. neighborip-addressactivate

15. neighborip-addresssend-community both

16. neighborip-addressroute-map map-name in

17. exit

18. address-family vpnv6

19. neighborip-addressactivate

20. neighborip-addresssend-community both

21. neighborip-addressroute-map map-name in

22. exit

23. route-map map-tagpermit position

24. set ip next-hop encapsulate l3vpn profile name

25. set ipv6 next-hop encapsulate l3vpn profile name

26. exit

27. exit

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configureterminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

router bgpas-number

Example:

Router (config)# router bgp 100

Specifies the number of an autonomous system that identifies the router to other BGP routers, tags the routing information passed along, and enters router configuration mode.

Step 4

bgp log-neighbor-changes

Example:

Router (config-router)# bgp log-neighbor-changes

Enables logging of BGP neighbor resets.

Step 5

neighborip-addressremote-asas-number

Example:

Router (config-router)# neighbor 10.10.10.6 remote-as 100

Adds an entry to the BGP or multiprotocol BGP neighbor table.

Step 6

neighborip-addressupdate-sourceinterface-type interface-name

Example:

Router (config-router)# neighbor 10.10.10.6 update-source loopback 0

Allows BGP sessions to use any operational interface for TCP connections.

Enables the Cisco IOS software to advertise a network route without waiting for an IGP.

Step 9

redistribute connected

Example:

Router (config-router-af)# redistribute connected

Redistributes routes from one routing domain into another routing domain and allows the target protocol to redistribute routes learned by the source protocol and connected prefixes on those interfaces over which the source protocol is running.

•If the match criteria are met for this route map, the route is redistributed as controlled by the set actions.

•If the match criteria are not met, the next route map with the same map tag is tested. If a route passes none of the match criteria for the set of route maps sharing the same name, it is not redistributed by that set.

•The position argument indicates the position that new route map will have in the list of route maps already configured with the same name.

What to Do Next

You can perform the following to make sure that the configuration is working properly.

Check the VRF Prefix

Verify that the specified VRF prefix has been received by BGP. The BGP table entry should show that the route map has worked and that the next hop is showing in the RiV. Use the show ip bgp vpnv4 command as shown in this example.

Router# show ip bgp vpnv4 vrf customer 209.165.200.250

BGP routing table entry for 100:1:209.165.200.250/24, version 12

Paths: (1 available, best #1)

Not advertised to any peer

Local

209.165.200.251 in "my riv" from 209.165.200.251 (209.165.200.251)

Origin incomplete, metric 0, localpref 100, valid, internal, best

Extended Community: RT:100:1

Confirm that the same information has been propagated to the routing table:

Router# show ip route vrf customer 209.165.200.250

Routing entry for 209.165.200.250/24

Known via "bgp 100", distance 200, metric 0, type internal

Last update from 209.165.200.251 00:23:07 ago

Routing Descriptor Blocks:

* 209.165.200.251 (my riv), from 209.165.200.251, 00:23:07 ago

Route metric is 0, traffic share count is 1

AS Hops 0

CEF Switching

You can also verify that CEF switching is working as expected:

Router# show ip cef vrf customer209.165.200.250

209.165.200.250/24, version 6, epoch 0

0 packets, 0 bytes

tag information set

local tag: VPN-route-head

fast tag rewrite with Tu1, 123.1.1.2, tags imposed: {17}

via 209.165.200.251, 0 dependencies, recursive

next hop 209.165.200.251, Tunnel1 via 209.165.200.251/32 (my riv)

valid adjacency

tag rewrite with Tu1, 209.165.200.251, tags imposed: {17}

Endpoint Creation

Note that in this example display the tunnel endpoint has been created correctly:

Router# show tunnel endpoint tunnel 1

Tunnel1 running in multi-GRE/IP mode

RFC2547/L3VPN Tunnel endpoint discovery is active on Tu1

Transporting l3vpn traffic to all routes recursing through "my riv"

Endpoint 209.165.200.251 via destination 209.165.200.251

Endpoint 209.165.200.254 via destination 209.165.200.254

Adjacency

Confirm that the corresponding adjacency has been created.

Router# show adjacency Tunnel 1 interface

Protocol Interface Address

TAG Tunnel1 209.165.200.251(4)

15 packets, 1980 bytes

4500000000000000FF2FC3C77B010103

7B01010200008847

Epoch: 0

Fast adjacency disabled

IP redirect disabled

IP mtu 1472 (0x0)

Fixup enabled (0x2)

GRE tunnel

Adjacency pointer 0x624A1580, refCount 4

Connection Id 0x0

Bucket 121

Note that because MPLS is being transported over mGRE, the LINK_TAG adjacency is the relevant adjacency. The MTU reported in the adjacency is the payload length (including the MPLS label) that the packet will accept. The MAC string shown in the adjacency display can be interpreted as follows:

You can use the show l3vpn encapsulation profile-name command to get information on the basic state of the application. The output of this command provides you details on the references to the tunnel and VRF.

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

Feature Information for Dynamic L3 VPNs with mGRE Tunnels

Table 1 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.0(23)S or a later release appear in the table.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 1 Feature Information for Dynamic L3 VPNs with mGRE Tunnels

Feature Name

Releases

Feature Information

Dynamic Layer 3 VPNs with Multipoint GRE Tunnels

12.0(23)S

This feature provides an L3 transport mechanism based on an enhanced mGRE tunneling technology for use in IP networks.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.